Its php. They are your session files. For more details checkout
session.save_path. Also take a look at the three parameters which control PHP's automatic session garbage collection: session.gc_probability, session.gc_divisor and session.gc_maxlifetime (further down on the same page). If you have a release php.ini file, it should have very good comments also explaining these settings.